@zackbart/connecta 0.15.0 → 0.16.0

package/bin/connecta.mjs

@@ -64,7 +64,7 @@ async function init() {
     // Restore both conventions explicitly in the generated project.
     await writeFile(
       join(stage, ".gitignore"),
-      ".connecta-state.json\n.env\nnode_modules/\n",
+      ".connecta-state.json\n.connecta-activity.jsonl\n.env\nnode_modules/\n",
     );
     await rm(join(stage, "CLAUDE.md"), { force: true });
     try {
@@ -186,6 +186,20 @@ async function doctor() {
   if (health.status !== "ok") {
     throw new Error(`Unexpected health status: ${String(health.status)}`);
   }
+  // Whatever ran the program is what doctor names. The deployment reports its
+  // own sandbox and a deployment that reports none gets an executor-neutral
+  // line — anything else is doctor asserting a sandbox it never saw (#368).
+  // The string arrives from a server and lands in a terminal, so it is
+  // sanitized here too rather than trusted twice.
+  const executorName =
+    typeof health.executor?.name === "string"
+      ? health.executor.name
+          .replace(/[^\w .+-]+/g, " ")
+          .replace(/\s+/g, " ")
+          .trim()
+          .slice(0, 40)
+          .trim()
+      : "";
   let requestId = 0;
   const mcp = async (method, params) =>
     jsonResponse(
@@ -240,13 +254,40 @@ async function doctor() {
     JSON.parse(executed.result?.content?.[0]?.text ?? "null");
   if (executed.result?.isError || executionResult?.result !== 42) {
     throw new Error(
-      `QuickJS execution check failed: ${JSON.stringify(executed.result)}`,
+      `${executorName ? `${executorName} execution` : "execute_code"} check ` +
+        `failed: ${JSON.stringify(executed.result)}`,
+    );
+  }
+
+  // Drift is reported, never failed on. A downstream that grew a tool nobody
+  // has classified is a maintainer's next task, not a broken deployment: the
+  // unclassified tool already fails closed onto call_destructive_tool. These
+  // counts come from refreshes the deployment already served, so a deployment
+  // that has answered no catalog request yet reports nothing here (#343).
+  const drifted = Object.entries(health.catalogDrift ?? {}).filter(
+    ([, report]) =>
+      report.unclassifiedTools ||
+      report.unservedTools ||
+      report.annotationConflicts ||
+      report.schemaChanges,
+  );
+  for (const [connectorId, report] of drifted) {
+    console.warn(
+      `[connecta] catalog drift on "${connectorId}" (observed ` +
+        `${report.observedAt}): ${report.unclassifiedTools} unclassified, ` +
+        `${report.unservedTools} no longer served, ` +
+        `${report.annotationConflicts} annotation conflict(s), ` +
+        `${report.schemaChanges} schema change(s).`,
     );
   }
 
   console.log(
     `Connecta doctor passed: ${health.connectors} connector(s), ` +
-      "QuickJS executed, prescribed seven-tool surface.",
+      `${executorName ? `${executorName} executed` : "code executed"}, ` +
+      "prescribed seven-tool surface" +
+      (drifted.length > 0
+        ? `, catalog drift on ${drifted.length} connector(s).`
+        : "."),
   );
 }
 

package/dist/access-tokens.d.ts

@@ -29,4 +29,3 @@ export declare class AccessTokenManager {
     revoke(id: string, revokedBy: string): Promise<AccessTokenMetadata | null>;
     private authorize;
 }
-//# sourceMappingURL=access-tokens.d.ts.map

package/dist/access-tokens.js

@@ -222,4 +222,3 @@ export class AccessTokenManager {
         return { ok: true, subjectId: record.id };
     }
 }
-//# sourceMappingURL=access-tokens.js.map

package/dist/activity.d.ts

@@ -1,4 +1,4 @@
-import type { Logger } from "./types.js";
+import type { CatalogDriftCounts, Logger } from "./types.js";
 export type ActivityCallSource = "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code";
 export type ActivityOutcome = "success" | "error" | "timeout" | "cancelled";
 export type AgentFriction = "tool_not_found" | "schema_retry" | "destructive_reroute" | "auth_required" | "result_too_large";
@@ -51,6 +51,26 @@ export interface ToolCallActivityEvent {
     serverVersion: string;
     deploymentId?: string;
 }
+/**
+ * A downstream catalog moved away from the manifest a release reviewed.
+ *
+ * Four integers and an id: the type has nowhere to put a tool name, a schema,
+ * an argument, a result, or a downstream error string, which is the same
+ * construction guarantee `ToolCallActivityEvent` makes. Which tool drifted is
+ * deliberately absent — the runtime reports that something did, and the
+ * maintainer-run check with a live catalog in front of it names names
+ * ([#343](https://github.com/zackbart/connecta/issues/343),
+ * [#351](https://github.com/zackbart/connecta/issues/351)).
+ */
+export interface CatalogDriftActivityEvent extends CatalogDriftCounts {
+    schemaVersion: 1;
+    id: string;
+    occurredAt: string;
+    connectorId: string;
+    serverName: string;
+    serverVersion: string;
+    deploymentId?: string;
+}
 export interface ActivityPage {
     events: ToolCallActivityEvent[];
     nextCursor?: string;
@@ -69,6 +89,13 @@ export interface ActivityReadPage {
 /** Write-only deployments can implement only this small, vendor-neutral seam. */
 export interface ActivitySink {
     record(event: ToolCallActivityEvent): void | Promise<void>;
+    /**
+     * Optional catalog-drift channel. Optional rather than a widened `record`,
+     * because a store written before drift existed already decided what a row
+     * looks like: a sink that does not implement this simply never hears about
+     * drift, and the operator still reads the same counts from connector status.
+     */
+    recordCatalogDrift?(event: CatalogDriftActivityEvent): void | Promise<void>;
 }
 /** Optional read side used by Connecta's authenticated Activity UI. */
 export interface ActivityReader {
@@ -86,6 +113,20 @@ export declare class InvalidActivityCursorError extends Error {
     constructor();
 }
 export type ActivityReadGate = (actor: ActivityActor) => boolean | Promise<boolean>;
+/**
+ * Deployment-scoped destination for drift observations. Not request-scoped:
+ * a drifting catalog is something the deployment saw, not something a caller
+ * did, so it carries no actor and no request id to attribute it to one.
+ */
+export interface CatalogDriftActivityContext {
+    sink: ActivitySink;
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    deploymentId?: string;
+    logger: Logger;
+}
 /** Request-scoped context shared by direct, batch, and code-mode call paths. */
 export interface ActivityRequestContext {
     sink: ActivitySink;
@@ -106,4 +147,11 @@ export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "to
  * Engine complete inline; Node promises remain detached from the response.
  */
 export declare function recordToolActivity(context: ActivityRequestContext | undefined, input: ActivityEventInput): void;
-//# sourceMappingURL=activity.d.ts.map
+/**
+ * Record one catalog-drift observation, best-effort like every other activity
+ * write: a store that is down, or a sink that never implemented the channel,
+ * can never change what a refresh returned to the caller who paid for it.
+ */
+export declare function recordCatalogDriftActivity(context: CatalogDriftActivityContext | undefined, input: {
+    connectorId: string;
+} & CatalogDriftCounts): void;

package/dist/activity.js

@@ -89,4 +89,37 @@ export function recordToolActivity(context, input) {
         context.logger.warn("[connecta] activity record failed", error);
     }
 }
-//# sourceMappingURL=activity.js.map
+/**
+ * Record one catalog-drift observation, best-effort like every other activity
+ * write: a store that is down, or a sink that never implemented the channel,
+ * can never change what a refresh returned to the caller who paid for it.
+ */
+export function recordCatalogDriftActivity(context, input) {
+    if (!context?.sink.recordCatalogDrift)
+        return;
+    const event = {
+        schemaVersion: 1,
+        id: crypto.randomUUID(),
+        occurredAt: new Date().toISOString(),
+        connectorId: boundedEchoText(input.connectorId, MAX_ACTIVITY_NAME_BYTES),
+        unclassifiedTools: input.unclassifiedTools,
+        unservedTools: input.unservedTools,
+        annotationConflicts: input.annotationConflicts,
+        schemaChanges: input.schemaChanges,
+        serverName: context.serverInfo.name,
+        serverVersion: context.serverInfo.version,
+        ...(context.deploymentId ? { deploymentId: context.deploymentId } : {}),
+    };
+    try {
+        const result = context.sink.recordCatalogDrift(event);
+        if (!result || typeof result.then !== "function") {
+            return;
+        }
+        void Promise.resolve(result).catch((error) => {
+            context.logger.warn("[connecta] catalog drift record failed", error);
+        });
+    }
+    catch (error) {
+        context.logger.warn("[connecta] catalog drift record failed", error);
+    }
+}

package/dist/apps-shell.d.ts

@@ -37,4 +37,3 @@ export declare const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
  * no direct network.
  */
 export declare const PROGRAM_UI_SHELL_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>connecta program view</title>\n    <style>\n      html,\n      body {\n        margin: 0;\n        padding: 0;\n        background: transparent;\n      }\n      #program-view {\n        display: block;\n        width: 100%;\n        min-height: 480px;\n        border: 0;\n      }\n    </style>\n  </head>\n  <body>\n    <iframe\n      id=\"program-view\"\n      title=\"Program-rendered view\"\n      sandbox=\"allow-scripts\"\n      srcdoc=\"\"\n    ></iframe>\n    <script>\n      (function () {\n        \"use strict\";\n        // The outer shell is the only host peer. The payload frame is\n        // sandboxed to scripts alone, with no same-origin escape. Its one\n        // optional message dialect is handled below and translated into\n        // bounded call_tool requests; raw JSON-RPC is never forwarded.\n        var host = window.parent;\n        var view = document.getElementById(\"program-view\");\n        var initializeId = \"connecta-ui-initialize\";\n        var lastWidth = 0;\n        var lastHeight = 0;\n        var reads = null;\n        var hostCanCallTools = false;\n        var nextHostRequestId = 0;\n        var pendingHostReads = Object.create(null);\n        var activeHostReads = 0;\n        var maxActiveHostReads = 8;\n\n        function send(message) {\n          if (!host || host === window) return;\n          host.postMessage(message, \"*\");\n        }\n\n        function notify(method, params) {\n          send({ jsonrpc: \"2.0\", method: method, params: params });\n        }\n\n        // Program views are fixed-height by construction. The shell has no\n        // content-height bridge to the payload frame, so it can never learn\n        // the payload's content height, and\n        // what it reports here is its own box: the min-height above, unless\n        // the host has given it more. Taller content scrolls inside the inner\n        // frame rather than growing the view. Raising the min-height is the\n        // only lever; a content-height signal would cost the isolation.\n        function reportSize() {\n          var width = Math.ceil(document.documentElement.clientWidth);\n          var height = Math.ceil(document.documentElement.scrollHeight);\n          if (width === lastWidth && height === lastHeight) return;\n          lastWidth = width;\n          lastHeight = height;\n          notify(\"ui/notifications/size-changed\", {\n            width: width,\n            height: height\n          });\n        }\n\n        function payload(result) {\n          if (!result || typeof result !== \"object\") return null;\n          var meta = result._meta;\n          if (!meta || typeof meta !== \"object\") return null;\n          var value = meta[\"connecta/ui\"];\n          if (!value || typeof value !== \"object\") return null;\n          return typeof value.html === \"string\" && value.html.length > 0\n            ? value\n            : null;\n        }\n\n        // This function is serialized into the opaque-origin payload frame.\n        // It knows no addresses and has no host channel of its own: one named\n        // read request goes to the trusted outer shell and one correlated\n        // result comes back.\n        function payloadReadBridge() {\n          \"use strict\";\n          var pending = Object.create(null);\n          var nextId = 0;\n\n          function read(name, args) {\n            return new Promise(function (resolve, reject) {\n              var id = String(++nextId);\n              pending[id] = { resolve: resolve, reject: reject };\n              try {\n                window.parent.postMessage({\n                  type: \"connecta/read\",\n                  id: id,\n                  name: name,\n                  args: args === undefined ? {} : args\n                }, \"*\");\n              } catch (error) {\n                delete pending[id];\n                reject(error);\n              }\n            });\n          }\n\n          Object.defineProperty(globalThis, \"connecta\", {\n            value: Object.freeze({ read: read }),\n            configurable: false,\n            enumerable: true,\n            writable: false\n          });\n\n          window.addEventListener(\"message\", function (event) {\n            if (event.source !== window.parent) return;\n            var message = event.data;\n            if (!message || message.type !== \"connecta/read-result\") return;\n            var waiter = pending[message.id];\n            if (!waiter) return;\n            delete pending[message.id];\n            if (message.ok) waiter.resolve(message.value);\n            else waiter.reject(new Error(message.error || \"Read failed\"));\n          });\n        }\n\n        function htmlWithReadBridge(html) {\n          var script =\n            \"<scr\" + \"ipt>(\" + payloadReadBridge.toString() + \")();</scr\" + \"ipt>\";\n          var head = /<head(?:\\s[^>]*)?>/i.exec(html);\n          if (head) {\n            var at = (head.index || 0) + head[0].length;\n            return html.slice(0, at) + script + html.slice(at);\n          }\n          var document = /<html(?:\\s[^>]*)?>/i.exec(html);\n          if (document) {\n            var afterHtml = (document.index || 0) + document[0].length;\n            return html.slice(0, afterHtml) + \"<head>\" + script + \"</head>\" + html.slice(afterHtml);\n          }\n          return script + html;\n        }\n\n        function render(params) {\n          var value =\n            payload(params) ||\n            payload(params && params.result) ||\n            payload(params && params.toolResult);\n          if (value === null) return;\n          reads = value.reads && typeof value.reads === \"object\"\n            ? value.reads\n            : null;\n          view.srcdoc = reads\n            ? htmlWithReadBridge(value.html)\n            : value.html;\n          reportSize();\n        }\n\n        function readError(message, fallback) {\n          if (message && typeof message.message === \"string\") return message.message;\n          if (message && message.data && typeof message.data.message === \"string\") {\n            return message.data.message;\n          }\n          return fallback;\n        }\n\n        function finishInnerRead(innerId, ok, value) {\n          if (!view.contentWindow) return;\n          view.contentWindow.postMessage(ok\n            ? { type: \"connecta/read-result\", id: innerId, ok: true, value: value }\n            : { type: \"connecta/read-result\", id: innerId, ok: false, error: value }, \"*\");\n        }\n\n        function beginInnerRead(message) {\n          if (!hostCanCallTools) {\n            finishInnerRead(message && message.id, false, \"This host does not support app-initiated server tool calls\");\n            return;\n          }\n          if (!message || typeof message.id !== \"string\" || typeof message.name !== \"string\") return;\n          if (!reads || !Object.prototype.hasOwnProperty.call(reads, message.name)) {\n            finishInnerRead(message.id, false, \"Unknown read binding\");\n            return;\n          }\n          if (activeHostReads >= maxActiveHostReads) {\n            finishInnerRead(message.id, false, \"Too many concurrent reads\");\n            return;\n          }\n          var binding = reads[message.name];\n          if (!binding || typeof binding !== \"object\" || typeof binding.address !== \"string\") {\n            finishInnerRead(message.id, false, \"Invalid read binding\");\n            return;\n          }\n          var supplied = message.args;\n          if (!supplied || typeof supplied !== \"object\" || Array.isArray(supplied)) {\n            finishInnerRead(message.id, false, \"Read arguments must be an object\");\n            return;\n          }\n          var allowed = Array.isArray(binding.viewArgs) ? binding.viewArgs : [];\n          var suppliedKeys = Object.keys(supplied);\n          for (var i = 0; i < suppliedKeys.length; i++) {\n            var key = suppliedKeys[i];\n            if (allowed.indexOf(key) === -1) {\n              finishInnerRead(message.id, false, \"Undeclared read argument \" + JSON.stringify(key));\n              return;\n            }\n          }\n          var args = Object.create(null);\n          var fixed = binding.fixedArgs && typeof binding.fixedArgs === \"object\"\n            ? binding.fixedArgs\n            : {};\n          Object.keys(fixed).forEach(function (key) { args[key] = fixed[key]; });\n          suppliedKeys.forEach(function (key) { args[key] = supplied[key]; });\n\n          var hostId = \"connecta-ui-read-\" + String(++nextHostRequestId);\n          pendingHostReads[hostId] = { innerId: message.id };\n          activeHostReads++;\n          send({\n            jsonrpc: \"2.0\",\n            id: hostId,\n            method: \"tools/call\",\n            params: {\n              name: \"call_tool\",\n              arguments: {\n                address: binding.address,\n                args: args,\n                resultMode: \"value\"\n              }\n            }\n          });\n        }\n\n        function finishHostRead(message) {\n          var pending = pendingHostReads[message.id];\n          if (!pending) return false;\n          delete pendingHostReads[message.id];\n          activeHostReads--;\n          if (message.error) {\n            finishInnerRead(pending.innerId, false, readError(message.error, \"Host rejected read\"));\n            return true;\n          }\n          var toolResult = message.result;\n          if (!toolResult || typeof toolResult !== \"object\") {\n            finishInnerRead(pending.innerId, false, \"Host returned an invalid tool result\");\n            return true;\n          }\n          var structured = toolResult.structuredContent;\n          if (toolResult.isError || (structured && structured.ok === false)) {\n            var detail = structured && structured.error;\n            var content = Array.isArray(toolResult.content)\n              ? toolResult.content.find(function (block) { return block && block.type === \"text\"; })\n              : null;\n            finishInnerRead(\n              pending.innerId,\n              false,\n              readError(detail, content && content.text ? content.text : \"Read failed\")\n            );\n            return true;\n          }\n          var value = structured && structured.ok === true &&\n              Object.prototype.hasOwnProperty.call(structured, \"data\")\n            ? structured.data\n            : structured !== undefined\n              ? structured\n              : toolResult;\n          finishInnerRead(pending.innerId, true, value);\n          return true;\n        }\n\n        window.addEventListener(\"message\", function (event) {\n          var message = event.data;\n          if (event.source === view.contentWindow) {\n            if (message && message.type === \"connecta/read\") beginInnerRead(message);\n            return;\n          }\n          if (event.source !== host) return;\n          if (!message || message.jsonrpc !== \"2.0\") return;\n          if (message.id !== undefined && finishHostRead(message)) return;\n          if (message.method === \"ui/notifications/tool-result\") {\n            render(message.params);\n            return;\n          }\n          if (message.method === \"ui/resource-teardown\") {\n            // A host->view request, not a notification: the host waits for\n            // this reply before it tears the view down. There is nothing to\n            // release, so answer immediately rather than make it time out.\n            if (message.id !== undefined && message.id !== null) {\n              send({ jsonrpc: \"2.0\", id: message.id, result: {} });\n            }\n            return;\n          }\n          // Only a completed handshake earns \"initialized\". A JSON-RPC error\n          // response carries the same id, and announcing initialization on one\n          // would assert a handshake that never happened.\n          if (message.id === initializeId && message.result !== undefined) {\n            var capabilities = message.result.hostCapabilities;\n            hostCanCallTools = Boolean(capabilities && capabilities.serverTools);\n            notify(\"ui/notifications/initialized\", {});\n          }\n        });\n\n        window.addEventListener(\"resize\", reportSize);\n        view.addEventListener(\"load\", reportSize);\n\n        // Every field here is required by the Apps initialize schema, and a\n        // conforming host rejects the request outright when one is missing \u2014\n        // which would strand the shell before any tool result arrives.\n        send({\n          jsonrpc: \"2.0\",\n          id: initializeId,\n          method: \"ui/initialize\",\n          params: {\n            appInfo: { name: \"connecta program view\", version: \"1\" },\n            appCapabilities: {},\n            protocolVersion: \"2026-01-26\"\n          }\n        });\n        reportSize();\n      })();\n    </script>\n  </body>\n</html>\n";
-//# sourceMappingURL=apps-shell.d.ts.map

package/dist/apps-shell.js

@@ -363,4 +363,3 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
   </body>
 </html>
 `;
-//# sourceMappingURL=apps-shell.js.map

package/dist/auth/bearer.d.ts

@@ -9,4 +9,3 @@ export interface BearerTokenOptions {
  * falls through so a co-configured Clerk provider can still admit the request.
  */
 export declare function bearerToken(secret: string, options?: BearerTokenOptions): InboundAuth;
-//# sourceMappingURL=bearer.d.ts.map

package/dist/auth/bearer.js

@@ -46,4 +46,3 @@ export function bearerToken(secret, options = {}) {
         },
     };
 }
-//# sourceMappingURL=bearer.js.map

package/dist/auth/clerk.d.ts

@@ -34,4 +34,3 @@ export interface ClerkAuthOptions {
  */
 export declare function clerkAuth(opts: ClerkAuthOptions): InboundAuth;
 export {};
-//# sourceMappingURL=clerk.d.ts.map

package/dist/auth/clerk.js

@@ -20,11 +20,45 @@ function tokenShape(request) {
         return "jwt";
     return "other";
 }
-/** Clerk Frontend API origin, derived from pk_(test|live)_<b64 domain>. */
+/**
+ * Clerk Frontend API origin, derived from pk_(test|live)_<b64 domain>.
+ *
+ * The key is operator config, and a key that cannot yield an origin is a
+ * structural mistake: it throws here, at construction, in the same voice as the
+ * `allowedDomains` checks. Left unvalidated, `atob` raises a bare
+ * `InvalidCharacterError` from inside the returned object — which, on a
+ * deployment that builds per request (the Workers shape), turns every route
+ * including `/health` into a 500 with a stack that names base64 rather than the
+ * environment variable the operator has to fix.
+ *
+ * The rejected value is never quoted back. A publishable key is public, but the
+ * commonest way to land here is pasting the *secret* key into the publishable
+ * slot, and a startup error is a log line.
+ */
 function fapiUrl(publishableKey) {
-    const key = publishableKey.replace(/^pk_(test|live)_/, "");
-    const decoded = atob(key).replace(/\$$/, "");
-    return `https://${decoded}`;
+    const shape = " Copy the publishable key from the Clerk dashboard: `pk_test_` or " +
+        "`pk_live_` followed by the base64-encoded Frontend API domain.";
+    if (typeof publishableKey !== "string" || publishableKey === "") {
+        throw new Error("clerkAuth: `publishableKey` is missing or not a string." + shape);
+    }
+    const encoded = /^pk_(?:test|live)_([A-Za-z0-9+/=]+)$/.exec(publishableKey)?.[1];
+    if (encoded === undefined) {
+        throw new Error("clerkAuth: `publishableKey` is not a Clerk publishable key." + shape);
+    }
+    let decoded;
+    try {
+        decoded = atob(encoded);
+    }
+    catch {
+        throw new Error("clerkAuth: `publishableKey` does not carry decodable base64." + shape);
+    }
+    // Clerk terminates the encoded domain with `$`; everything else is the host.
+    const domain = decoded.replace(/\$$/, "");
+    if (!isDomain(domain)) {
+        throw new Error("clerkAuth: `publishableKey` does not decode to a Frontend API domain." +
+            shape);
+    }
+    return `https://${domain}`;
 }
 const GATE_ALLOWED_TTL_MS = 60 * 1000;
 const GATE_FORBIDDEN_TTL_MS = 30 * 1000;
@@ -175,6 +209,9 @@ function emailDomain(email) {
  */
 export function clerkAuth(opts) {
     assertNoRetiredToolkitOptions("clerkAuth", opts);
+    // Before the Clerk client, so a malformed key fails as a connecta
+    // configuration error rather than however the SDK happens to treat it.
+    const frontendApiUrl = fapiUrl(opts.publishableKey);
     const clerk = createClerkClient({
         secretKey: opts.secretKey,
         publishableKey: opts.publishableKey,
@@ -329,12 +366,12 @@ export function clerkAuth(opts) {
     };
     return {
         kind: "clerk",
-        activityActorNamespace: fapiUrl(opts.publishableKey),
+        activityActorNamespace: frontendApiUrl,
         activityActorLabel: resolveActivityLabel,
         uiAuth: {
             kind: "clerk",
             publishableKey: opts.publishableKey,
-            frontendApiUrl: fapiUrl(opts.publishableKey),
+            frontendApiUrl,
             ...(opts.signInUrl ? { signInUrl: opts.signInUrl } : {}),
             ...(opts.signUpUrl ? { signUpUrl: opts.signUpUrl } : {}),
         },
@@ -350,14 +387,14 @@ export function clerkAuth(opts) {
                 pathname === "/.well-known/oauth-protected-resource/mcp") {
                 return Response.json({
                     resource: `${base}/mcp`,
-                    authorization_servers: [fapiUrl(opts.publishableKey)],
+                    authorization_servers: [frontendApiUrl],
                     bearer_methods_supported: ["header"],
                     scopes_supported: scopes,
                 }, { headers: CORS_HEADERS });
             }
             if (pathname === "/.well-known/oauth-authorization-server") {
                 try {
-                    const upstream = await fetch(`${fapiUrl(opts.publishableKey)}/.well-known/oauth-authorization-server`);
+                    const upstream = await fetch(`${frontendApiUrl}/.well-known/oauth-authorization-server`);
                     if (!upstream.ok) {
                         return Response.json({ error: "upstream authorization server metadata unavailable" }, { status: 502, headers: CORS_HEADERS });
                     }
@@ -426,4 +463,3 @@ export function clerkAuth(opts) {
         },
     };
 }
-//# sourceMappingURL=clerk.js.map

package/dist/auth/downstream-oauth.d.ts

@@ -121,4 +121,3 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     resetAuthorization(operatorDisconnected?: boolean): Promise<void>;
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
 }
-//# sourceMappingURL=downstream-oauth.d.ts.map

package/dist/auth/downstream-oauth.js

@@ -434,4 +434,3 @@ export class KvOAuthProvider {
         }
     }
 }
-//# sourceMappingURL=downstream-oauth.js.map

package/dist/call-admission.d.ts

@@ -78,4 +78,3 @@ export declare class ConnectorCallAdmissionController {
     private budgetLimited;
     private cancelled;
 }
-//# sourceMappingURL=call-admission.d.ts.map

package/dist/call-admission.js

@@ -341,4 +341,3 @@ export class ConnectorCallAdmissionController {
         return new CallAdmissionError("cancelled", "timeout", `Connector "${this.connectorId}" call was cancelled before admission.`, { cause: signal.reason });
     }
 }
-//# sourceMappingURL=call-admission.js.map

package/dist/catalog-drift.d.ts

@@ -0,0 +1,99 @@
+import type { CatalogDriftCounts, CatalogDriftReport, Connector, ToolDef } from "./types.js";
+/**
+ * Rebuild a drift report as four counts and a bounded timestamp.
+ *
+ * `Connector.catalogDrift()` sits on the open plugin seam, and what it returns
+ * lands in the body of unauthenticated `/health` and on connector status.
+ * TypeScript constrains neither an extra enumerable property nor the length of
+ * `observedAt` at runtime, so "counts and nothing else" is *made* true here —
+ * at the boundary where third-party output becomes a response — rather than
+ * trusted. The activity path reconstructs its five fields for the same reason.
+ */
+export declare function boundedCatalogDrift(report: CatalogDriftReport | undefined): CatalogDriftReport | undefined;
+/**
+ * What a release decided a tool does. `"read-only"` is observational;
+ * `"destructive"` modifies or removes state that already exists; `"additive"`
+ * only brings something new into being. Both writes leave the read-only path
+ * — the distinction decides whether the connection asserts `destructiveHint`,
+ * which shapes the approval copy a human reads.
+ */
+type VettedVerdict = "read-only" | "additive" | "destructive";
+/** One tool as a release reviewed it. */
+interface VettedToolRecord {
+    verdict: VettedVerdict;
+    /**
+     * Digest of the input and output schemas that release read, or undefined
+     * when no release has recorded them. Undefined is not "unchanged": a
+     * manifest with no digest cannot report a schema change, and says so by
+     * counting none. `npm run drift:check -- --record` reads them from a live
+     * catalog and prints the block a release pastes in
+     * ([#351](https://github.com/zackbart/connecta/issues/351)).
+     */
+    schemaDigest?: string;
+}
+/**
+ * The vetted manifest one hosted-MCP proxy ships: every tool name a release
+ * reviewed, what it reviewed it as, and — where a release recorded them — the
+ * schemas it read. This is the single per-provider source P13 asks for, so the
+ * classification the connector applies and the classification a drift check
+ * compares against cannot disagree.
+ */
+export interface VettedCatalog {
+    /** Manifest format. Bumped when the comparison itself changes shape. */
+    version: 1;
+    tools: ReadonlyMap<string, VettedToolRecord>;
+}
+export interface VettedCatalogInput {
+    /** Names whose contract is observational rather than mutating. */
+    reads: ReadonlySet<string>;
+    /** Names that write, with the verdict that shapes the approval copy. */
+    writes: ReadonlyMap<string, "additive" | "destructive">;
+    /**
+     * Schemas this release reviewed, as `name` → digest from
+     * {@link vettedSchemaDigest}. Omit entirely until a release has actually
+     * read them; an invented digest reports drift that never happened.
+     */
+    schemaDigests?: Readonly<Record<string, string>>;
+}
+/**
+ * Digest the schemas of one downstream tool.
+ *
+ * Canonical rather than literal, unlike the catalog fingerprint in
+ * `src/catalog-fingerprint.ts`: that one is deliberately conservative because a
+ * spurious cache write is cheap, while a spurious drift finding spends a
+ * maintainer's attention on a downstream that reordered its JSON keys.
+ * Description and annotations are excluded — a reworded description is P1's
+ * business, and an annotation change is already its own drift category.
+ */
+export declare function vettedSchemaDigest(tool: ToolDef): Promise<string>;
+/**
+ * Build a provider's manifest from the lists it already maintains.
+ *
+ * Throws when a name is classified twice, because a tool that is both a read
+ * and a write is a review mistake that must not boot: the annotation the
+ * connector would apply depends on which branch runs first, and "safe by
+ * default" cannot be decided by ordering.
+ */
+export declare function vettedCatalog(input: VettedCatalogInput): VettedCatalog;
+/**
+ * Compare a live catalog with the manifest and count what moved.
+ *
+ * Counts only, and by construction: there is nowhere here to put a tool name,
+ * a schema, or a downstream string, so no later surface has to remember to
+ * strip one. Reads nothing but the tools it was handed — the caller already
+ * fetched them to serve a request, and this function never fetches anything.
+ */
+export declare function detectCatalogDrift(catalog: VettedCatalog, tools: readonly ToolDef[]): Promise<CatalogDriftCounts>;
+/**
+ * Wrap a hosted-MCP connector in its vetted manifest: the classification the
+ * catalog is normalized with, and the drift check that rides the same listing.
+ *
+ * The check happens where the tools are already in hand and still unmodified —
+ * after the downstream answered, before the classification is applied. It adds
+ * no request of its own, which is the whole boundary: connecta watches a
+ * contract while it is serving a refresh the deployment asked for, and never
+ * initiates one to go looking ([#179](https://github.com/zackbart/connecta/issues/179),
+ * [#343](https://github.com/zackbart/connecta/issues/343)).
+ */
+export declare function withVettedCatalog(connector: Connector, catalog: VettedCatalog): Connector;
+export {};